diff --git a/charts/descheduler/README.md b/charts/descheduler/README.md index dc9a644d7..92b18a7c8 100644 --- a/charts/descheduler/README.md +++ b/charts/descheduler/README.md @@ -71,6 +71,7 @@ The following table lists the configurable parameters of the _descheduler_ chart | `priorityClassName` | The name of the priority class to add to pods | `system-cluster-critical` | | `schedulerName` | The name of the scheduler used to schedule the descheduler cronjob/deployment pods | `""` | | `runtimeClassName` | The RuntimeClass applied to the descheduler cronjob/deployment pods | `""` | +| `hostUsers` | If set (`true`/`false`), sets `hostUsers` on the pod spec to control user-namespace sharing | `nil` | | `rbac.create` | If `true`, create & use RBAC resources | `true` | | `resources` | Descheduler container CPU and memory requests/limits | _see values.yaml_ | | `serviceAccount.create` | If `true`, create a service account for the cron job | `true` | diff --git a/charts/descheduler/templates/cronjob.yaml b/charts/descheduler/templates/cronjob.yaml index 611687ec5..7b2a1644e 100644 --- a/charts/descheduler/templates/cronjob.yaml +++ b/charts/descheduler/templates/cronjob.yaml @@ -93,6 +93,9 @@ spec: {{- if .Values.runtimeClassName }} runtimeClassName: {{ .Values.runtimeClassName }} {{- end }} + {{- if kindIs "bool" .Values.hostUsers }} + hostUsers: {{ .Values.hostUsers }} + {{- end }} serviceAccountName: {{ template "descheduler.serviceAccountName" . }} {{- if kindIs "bool" .Values.automountServiceAccountToken }} automountServiceAccountToken: {{ .Values.automountServiceAccountToken }} diff --git a/charts/descheduler/templates/deployment.yaml b/charts/descheduler/templates/deployment.yaml index 9bde9a2f3..6d121d41c 100644 --- a/charts/descheduler/templates/deployment.yaml +++ b/charts/descheduler/templates/deployment.yaml @@ -47,6 +47,9 @@ spec: {{- if .Values.runtimeClassName }} runtimeClassName: {{ .Values.runtimeClassName }} {{- end }} + {{- if kindIs "bool" .Values.hostUsers }} + hostUsers: {{ .Values.hostUsers }} + {{- end }} serviceAccountName: {{ template "descheduler.serviceAccountName" . }} {{- if kindIs "bool" .Values.automountServiceAccountToken }} automountServiceAccountToken: {{ .Values.automountServiceAccountToken }} diff --git a/charts/descheduler/tests/cronjob_test.yaml b/charts/descheduler/tests/cronjob_test.yaml index 1d25437f0..d91cb2de1 100644 --- a/charts/descheduler/tests/cronjob_test.yaml +++ b/charts/descheduler/tests/cronjob_test.yaml @@ -41,3 +41,27 @@ tests: path: spec.jobTemplate.spec.template.spec.schedulerName - notExists: path: spec.jobTemplate.spec.template.spec.runtimeClassName + + - it: sets hostUsers to false when configured + set: + hostUsers: false + template: templates/cronjob.yaml + asserts: + - equal: + path: spec.jobTemplate.spec.template.spec.hostUsers + value: false + + - it: sets hostUsers to true when configured + set: + hostUsers: true + template: templates/cronjob.yaml + asserts: + - equal: + path: spec.jobTemplate.spec.template.spec.hostUsers + value: true + + - it: omits hostUsers by default + template: templates/cronjob.yaml + asserts: + - notExists: + path: spec.jobTemplate.spec.template.spec.hostUsers diff --git a/charts/descheduler/tests/deployment_test.yaml b/charts/descheduler/tests/deployment_test.yaml index 7e6607cac..e795a1134 100644 --- a/charts/descheduler/tests/deployment_test.yaml +++ b/charts/descheduler/tests/deployment_test.yaml @@ -73,3 +73,27 @@ tests: path: spec.template.spec.schedulerName - notExists: path: spec.template.spec.runtimeClassName + + - it: sets hostUsers to false when configured + set: + hostUsers: false + template: templates/deployment.yaml + asserts: + - equal: + path: spec.template.spec.hostUsers + value: false + + - it: sets hostUsers to true when configured + set: + hostUsers: true + template: templates/deployment.yaml + asserts: + - equal: + path: spec.template.spec.hostUsers + value: true + + - it: omits hostUsers by default + template: templates/deployment.yaml + asserts: + - notExists: + path: spec.template.spec.hostUsers diff --git a/charts/descheduler/values.yaml b/charts/descheduler/values.yaml index b3a5e13c5..37b5e3fb5 100644 --- a/charts/descheduler/values.yaml +++ b/charts/descheduler/values.yaml @@ -172,6 +172,11 @@ schedulerName: "" # Leave empty to use the cluster default runtime. runtimeClassName: "" +# Set the Pod spec `hostUsers` field to control user-namespace sharing. +# Default is not set (the cluster default applies). Set to `false` to opt into +# user-namespace isolation, or `true` to share the host user namespace. +# hostUsers: false + nodeSelector: {} # foo: bar